Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09/01/2024, 11:40
General
-
Target
4e3490adb702ae3b86915ffe269d0e78.exe
-
Size
2.9MB
-
MD5
4e3490adb702ae3b86915ffe269d0e78
-
SHA1
e8f7a3718cc5397a0fbf6508a68aa9d3c84f6fcb
-
SHA256
6023379efb91da33aaa5280200af8e79a9306ff71aebcfacd4d479878eea1e28
-
SHA512
046a3fbaf288d95a5975351f9ffd138ae3c427c6cd0d4595c8842f5cff20ffbc797f13a4193109e02934b2352efff1cde8d734696a616ec2a35b7a00f1e6f1c3
-
SSDEEP
49152:Gom1VafO9sHd7wwFu58RiN74NH5HUyNRcUsCVOzetdZJ:81V0d7ww0p4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e3490adb702ae3b86915ffe269d0e78.exe"C:\Users\Admin\AppData\Local\Temp\4e3490adb702ae3b86915ffe269d0e78.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e3490adb702ae3b86915ffe269d0e78.exeC:\Users\Admin\AppData\Local\Temp\4e3490adb702ae3b86915ffe269d0e78.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5340dea2a5423d111e901dbb165c30da4
SHA1dec84e842b0086eab51edec84fd7b49315a61e7d
SHA2569fec276f3763a27df4f6bc8f76f0a16b3b212525077e38f48c2a9e5e91c535e8
SHA512e95c9ad43d7c9d446f1fe2594a0426fb4e7b38e445e9d37e79449bb416b3d9c76eaef08553a219b4ad5c3a1acfa929e249c93a5217e7a23a2517b29fe7ec170c
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB